Kaseya Community

IE8 terrible

  • So before I even did patch management on our customers PC, I immediately denied IE8 KB article under KB Override, everything was fine until 2 weeks ago when patches went out, somehow it deployed IE8 on a lot of PCs, and omg has it created a nightmare for me, I was able to roll it back on most of them to IE7, but there are like 5 that just have nothing but problems, and I go into Add/Remove and some show IE7 installed some show IE8 which is the wierdest thing, then there is no Remove option available anyways.

    Try to run manual install of IE8 and it gives error "Setup cannot uninstall the version of Internet Expleror 8 that is currently on your computer. To install a new Version (one that still cannot be removed), click OK. To stop the installation, click cancel."

    I'm clueless so its like it knows it cant even be removed, is there like a IE removal tool? lol Even if i uninstall it from Windows Components it still dont uninstall. Wouldnt be so mad if I allowed IE8 to install but its like I denied the KB override to absolutely make sure this was not going to be a problem.

    Legacy Forum Name: IE8 terrible,
    Legacy Posted By Username: tim@xxpert.net
  • prob should have made sure it was denied in your patch management.

    Whats so bad about IE8? After making sure it was stable we got it out pretty quick as it's a major improvement over 7. Much faster and nice to use.

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: chris@busy.co.nz
  • Your problem was probably due to Microsoft coming out with a new KB article for the IE8 update. Make sure KB944036 is blocked. I noticed this change recently in my own patch management.

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: CCDave
  • yea 944036 is what I had denied lol since Oct 10th.

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: tim@xxpert.net
  • If you have a policy set to approve patches by default, this CAN and WILL happen.

    If the end user has WAU enabled, this CAN and WILL happen (This is the more likely cause). Microsoft likes to push out new versions of IE with no mind for backwards compatibility, and if WAU is enabled... I know lots of realtors that had huge problems when MS first pushed IE7...

    I can't offer much advice on correcting this, but I can offer some advice to prevent it from happening in the future.

    First, make sure the local machine isn't updating on it's own.
    Patch Mgmt -> Configure -> Windows Auto Update.
    Choose the group you need to change, select "Disable", click "Select All", click "Apply". If you're doing patch management for a client, this should be the first step for any machine, make a script and add it to the template. Make sure your client knows to NOT manually use Windows Update, and delete the Windows Update shortcuts from the start menu, to reduce temptation.

    You might also want to set an alert to tell you if someone turns it back on (Monitor -> Agent Monitoring -> Alerts -> Patch Alert -> it's one of the checkboxes)

    Then make sure they aren't being approved by default.
    Patch Mgmt -> Patch Policy -> Approval by Policy
    make sure every category's Default Approval is either "denied" (red X) or "Pending Approval" (blue ?). You could set some things to default to "Approved" if you want, but use that with care. It really doesn't take long to verify and approve patches.

    Keep in mind there's also a selector at the top right of the table, one is by priority, and one is by category. No idea how those two views interact, but if you want to be thorough, set them both to "Pending Approval". Except maybe GWFL, language packs, extras packs, they can usually be denied outright.

    You'll want to go through all of the patch policies you're using and check this.

    After all that, if IE8 appears on a machine, you know it wasn't automatic, and you can bill them to remove it.


    It's a long shot, but on the failed uninstalls, have you tried manually installing IE7? Never tried it myself, but there should be some kind of force or silent option, either of these might skip past the warnings and install anyway.
    http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=9ae91ebe-3385-447c-8a30-081805b2f90b
    I doubt that would work anyway (version check), but you never know. Otherwise, it might be time to hide IE and give them mozilla with IE tabs.

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: dwujcik
  • dwujcik


    It's a long shot, but on the failed uninstalls, have you tried manually installing IE7? Never tried it myself, but there should be some kind of force or silent option, either of these might skip past the warnings and install anyway.

    http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=9ae91ebe-3385-447c-8a30-081805b2f90b

    I doubt that would work anyway (version check), but you never know. Otherwise, it might be time to hide IE and give them mozilla with IE tabs.




    I've created an install script for IE7, makes life easy(er). I don't think you can install IE 7 over 8.



    @Tim, once you've double, double checked what dwujcik has suggested, go through your patch policies again, there are, as I recall, 2 or 3 (possibly more) IE 8 "Patches" that will actually install it. MS is being very very sneaky about this one.





    I've also found this registry setting prevents the "automatic" installs



    Script Name: disable IE 8 automatic update

    Script Description: Disable Automatic Delivery of Internet Explorer 8.

    Run on machine you want it disabled



    IF Check Registry Value

    Parameter 1 : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\8.0

    Absent :true

    THEN

    Execute Shell Command

    Parameter 1 : reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup\8.0"

    Parameter 2 : 1

    OS Type : 0

    Execute Shell Command

    Parameter 1 : reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup\8.0" /v DoNotAllowIE80 /t REG_DWORD /d 1

    Parameter 2 : 1

    OS Type : 0

    ELSE





    Fire that on all machines (I'm not sure about 64bit, its been tested on 32bit systems only) and WU will think that IE 8 has been "uninstalled" and there fore not wanted and won't install. Should it appear on a machine after that you can safely say that a user installed it.



    Also I've found that once you've uninstalled IE8 (and rebooted) you should reinstall IE 7 just for good measure, so make sure you have the installer handy, then reboot again... we've seen some oddities happen when we've just uninstalled IE 8 and ran with it... mostly java(script) stuff on web pages (tring to print) and what not.

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: thirteentwenty